4 ms·
> and hijack those devices. And do what then? Serious question, I'm not a heavy user of Google Home/Chromecast, but my impression is that even if you hijack a
by creato 8y ago
> and hijack those devices.
And do what then? Serious question, I'm not a heavy user of Google Home/Chromecast, but my impression is that even if you hijack a device this way, the worst you can do is start streaming netflix or spotify, but with your own account to boot (not the account owner of the device you hijacked).
- hadrien01 8y agoYou can stream many types of content on a Chromecast (porn from a Chrome tab for instance, or your Android screen), and you don't need a Google account.
- lozaning 8y agoYou've got to be on the network to execute this attack, which means you could already cast all the porn you wanted to the device anyway.
- robohoe 8y agoTurn on all your lights!
- dragonwriter 8y agoThe hijack described takes them off the local network, but IIRC Home will only control devices on the same network, unless you—after you hijack it—you have access to connect it to some other service that controls the device, which requires already having the control you want to use the hijacked device for.
- lozaning 8y agoNah, they've got cloud to to cloud integrations for stuff like LIFX bulbs, which only connect back to the LIFX cloud.
- dragonwriter 8y agoRight. But the hijack proposed detaches the Home from the Google Account with which those integrations would be attached. The attacker could expose his own lights to the victim, but not the other way around.
- dragonwriter 8y ago> And do what then? For Assistant devices (Home, etc.) You can record (and get transcripts of) any requests made sent a Google Account you control, which can capture personal information. For Cast targets, you can stream content to them (audio and possibly video, depending on the device.) > the worst you can do is start streaming netflix or spotify Netflix or Spotify is probably not the worst unwanted content you could stream into someone else's home unrequested.
- mortehu 8y agoI don't think Google Home can forget its configured network without either access to that network, or physical access.
- unsignedint 8y agoIf network connection is down for any reasons, or deauth packet is received, Google Home falls back to setup mode.[0] In this mode, essentially Google Home becomes an access point without internet access and Google Home app can be used to configure new network. [0]: https://9to5google.com/2014/07/21/chromecast-vulnerability-to-hijacking-demonstrated-by-rickroll/ https://9to5google.com/2014/07/21/chromecast-vulnerability-t...
- mortehu 8y agoI think you're confusing Chromecast and Google Home. The article you linked is about Chromecast. They don't behave the same way. If you lose access to the original network, a Google Home device needs a factory reset via a button.
- unsignedint 8y agoThat's not how it works, at least for ones I have. The moment they lose connection, it will start broadcasting SSID with device name with ".b" added. It will accept configuration from Google Home app. That behavior is common between a set of Chromecasts and Google Homes as far as I can see.